DATA  PROTECTION  ACT  1998 


SUPERVISORY  POWERS  OF  THE  INFORMATION  COMMISSIONER 

ENFORCEMENT  NOTICE 


To:  SCL  Elections  Limited 

Of:  55  New  Oxford  Street 

London 
WC1A  IBS 

1.  SCL  Elections  Limited  is  a  data  controller  as  defined  in  section  1(1)  of 
the  Data  Protection  Act  1998  ("DPA"). 

2.  Section  4(4)  of  the  DPA  provides  that,  subject  to  section  27(1),  it  is 
the  duty  of  a  data  controller  to  comply  with  the  data  protection 
principles  in  relation  to  all  personal  data  with  respect  to  which  he  is  the 
data  controller. 

3.  The  Information  Commissioner  ("Commissioner")  has  considered  a 
request  for  assessment  made  under  section  42  of  the  DPA  by  Professor 
David  Carroll  ("the  complainant"). 

4.  The  request  for  assessment  concerned  the  failure  by  SCL  Elections 
Limited  ("the  data  controller")  to  supply  personal  data  requested  by 
way  of  a  subject  access  request  in  compliance  with  the  requirements 
of  section  7  of  the  DPA. 
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5.  The  complainant  made  a  subject  access  request  to  the  data  controller 
on  10  January  2017,  by  completing  an  online  form  at 
https://datareauests.cambridqeanalvtica.org 

6.  The  complainant  received  a  response  from  the  email  address 

data  .com  pliance(a)sclqroup.cc  informing  him  to  submit  a  £10  fee  and 
proof  of  ID  to  SCL  Elections  Ltd,  which  was  said  to  be  Cambridge 
Analytical  agent  for  the  purposes  of  subject  access  requests  under  the 
DPA. 

7.  Having  provided  the  required  information  and  fee,  the  complainant 
received  a  substantive  response  to  his  request  on  27  March  2017 
under  cover  of  a  letter  from  the  SCL  Group,  marked  for  and  behalf  of 
Cambridge  Analytica. 

8.  Under  cover  of  this  letter  the  complainant  was  provided  with  a 
spreadsheet  which  was  said  to  contain  all  of  the  personal  data  to  which 
he  was  entitled  to  under  the  DPA.  The  spreadsheet  contained 
information  under  three  separate  categories: 

(i)  "Core  data",  which  included  the  complainant's  name,  address,  date 
of  birth,  and  voter  ID. 

(ii)  "Election  returns",  which  included  the  complainant's  election 
returns  for  both  primary  and  general  elections  from  2000  to  2014,  and 
in  some  cases  it  is  understood  an  indication  of  the  political  party  to 
which  the  complainant  was  registered  at  the  time. 

(iii)  "Models",  which  included  a  profile  purporting  to  show  the 
complainant's  views  on  ten  issues  including  gun  rights,  education, 
healthcare,  immigration  and  the  environment,  ranking  the  apparent 
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importance  of  these  issues  to  the  complainant  between  1  and  10.  It 
also  included  his  likely  partisanship  categorised  by  both  his  registered 
and  unregistered  political  preference  and  likely  propensity  to  vote  in 
the  2016  general  election. 

9.  In  addition  the  data  controller  informed  the  complainant  that  it 
processed  this  data  for  the  purposes  of  "audience  opinion  /  behaviour 
research  and  polling;  statistical  analysis  and  predictive  algorithm 
development;  and  communications  /  outreach  support  services".  It 
explained  that  the  data  was  sourced  "..  through  reputable  data 
vendors"  and  "..  large  scale  research  through  research  partners".  It 
also  provided  a  very  generic  list  of  the  classes  of  recipients  of  the  data, 
including  "political  campaigns,  non-profit  organisations  and  commercial 
entities". 

10.  The  complainant  was  not  satisfied  with  the  response  to  his  subject 
access  request  and  complained  to  the  Commissioner.  Amongst  other 
things,  the  complainant  did  not  consider  that  he  had  been  provided 
with  all  of  the  personal  data  held  about  him  by  the  data  controller,  nor 
an  adequate  explanation  of  where  the  data  had  been  obtained  from  or 
how  it  would  be  used. 

11.  The  Commissioner  wrote  to  the  data  controller  about  this  matter  on  12 
September  2017.  The  data  controller  was  asked  a  number  of 
questions  in  relation  to  the  data  it  held  about  the  complainant,  for 
example  whether  it  had  provided  the  complainant  with  all  of  the 
personal  data  it  held;  what  purposes  it  processed  that  data  for; 
whether  it  had  relied  on  any  exemption  to  the  right  of  subject  access; 
and  further  details  as  to  where  the  data  had  been  obtained  from  and 
to  whom  it  had  been  disclosed. 
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12.  The  data  controller  responded  to  the  Commissioner  on  26  September 
2017  asserting  that  as  the  complainant  was  not  a  UK  citizen,  nor 
based  in  the  UK,  he  was  not  entitled  to  make  a  subject  access  request 
or  make  a  request  for  assessment  to  the  Commissioner  under  the  DPA. 
The  data  controller  stated  that  the  complainant  was  no  more  entitled 
to  make  a  subject  access  request  under  the  DPA  than  a  member  of 
the  Taliban  sitting  in  a  cave  in  the  remotest  corner  of  Afghanistan". 

The  data  controller  did  not  respond  to  the  specific  questions  raised  by 
the  Commissioner  in  her  correspondence  about  the  data  it  held  about 
the  complainant. 

13.  The  Commissioner  responded  to  the  data  controller  on  26  October 
2017  providing  a  detailed  explanation  as  to  why  the  complainant  was 
entitled  to  make  a  subject  access  request  under  the  DPA  and  why  her 
office  had  jurisdiction  to  consider  his  complaint.  The  Commissioner 
therefore  asked  for  a  response  to  the  questions  she  had  previously 
asked  the  data  controller  about  the  data  it  processed  about  the 
complainant. 

14.  The  data  controller  replied  to  the  Commissioner  on  2  November  2017. 
It  again  refused  to  accept  that  the  complainant  was  entitled  to  make  a 
subject  access  request  or  a  request  for  assessment  under  the  DPA, 
asserting  that  the  Commissioner  had  no  vires  to  consider  the 
complaint.  The  data  controller  informed  the  Commissioner  that  it  did 
"..  not  expect  to  be  further  harassed  with  this  sort  of  correspondence". 

15.  The  Commissioner  has  considered  the  data  controller's  compliance 
with  the  provisions  of  the  DPA  in  light  of  these  matters.  The  relevant 
provisions  of  the  DPA  are  the  Sixth  Data  Protection  Principle  and 
section  7. 
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16.  The  Sixth  Data  Protection  Principle  provides  at  Part  I  of  Schedule  1  to 
the  DPA  that: 

"Personal  data  shall  be  processed  in  accordance  with  the  rights  of  data 
subjects  under  this  Act. " 

17.  Paragraph  8(a)  of  Part  II  of  Schedule  1  to  the  DPA  further  provides 
that: 

"A  person  is  to  be  regarded  as  contravening  the  sixth  principle  if >  but 
only  if,  he  contravenes  section  7  by  failing  to  supply  information  in 
accordance  with  that  section. " 

18.  In  relevant  part,  section  7  of  the  DPA  provides  as  follows: 

(1)  Subject  to  the  following  provisions  of  this  section  and  to  sections  8, 
9  and  9A,  an  individual  is  entitled  - 

(a)  to  be  informed  by  any  data  controller  whether  personal  data 
of  which  that  individual  is  the  data  subject  are  being 
processed  by  or  on  behalf  of  that  data  controller > 

(b)  if  that  is  the  case ,  to  be  given  by  the  data  controller  a 
description  of  - 

(i)  the  personal  data  of  which  that  individual  is  the  subject, 

(ii)  the  purposes  for  which  they  are  being  or  are  to  be 
processed,  and 
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(Hi)  the  recipients  or  classes  of  recipients  to  whom  they  are 
or  may  be  disclosed , 

(c)  to  have  communicated  to  him  in  an  intelligible  form  - 

(i)  the  information  constituting  any  personal  data  of  which 
that  individual  is  the  data  subject,  and 

(ii)  any  information  available  to  the  data  controller  as  to  the 
source  of  those  data,  and 

(d)  where  the  processing  by  automatic  means  of  personal  data  of 
which  that  individual  is  the  data  subject  for  the  purpose  of 
evaluating  matters  relating  to  him  such  as,  for  example,  his 
performance  at  work,  his  creditworthiness,  his  reliability  or  his 
conduct,  has  constituted  or  is  likely  to  constitute  the  sole  basis  for 
any  decision  significantly  affecting  him,  to  be  informed  by  the 
data  controller  of  the  logic  involved  in  that  decision-taking. 

(2)  A  data  controller  is  not  obliged  to  supply  any  information  under 
subsection  (1)  unless  he  has  received— 

(a)  a  request  in  writing,  and 

(b)  except  in  prescribed  cases,  such  fee  (not  exceeding  the 
prescribed  maximum)  as  he  may  require. 

(3)  Where  a  data  controller— 

(a)  reasonably  requires  further  information  in  order  to  satisfy 
himself  as  to  the  identity  of  the  person  making  a  request 
under  this  section  and  to  locate  the  information  which  that 
person  seeks,  and 

(b)  has  informed  him  of  that  requirement, 
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the  data  controller  Is  not  obliged  to  comply  with  the  request 
unless  he  is  supplied  with  that  further  information. 

(4)  Where  a  data  controller  cannot  comply  with  the  request  without 
disclosing  information  relating  to  another  individual  who  can  be 
identified  from  that  information ,  he  is  not  obliged  to  comply  with  the 
request  unless— 

(a)  the  other  individual  has  consented  to  the  disclosure  of  the 
information  to  the  person  making  the  request ;  or 

(b)  it  is  reasonable  in  all  the  circumstances  to  comply  with  the 
request  without  the  consent  of  the  other  individual. 

(5)  In  subsection  (4)  the  reference  to  information  relating  to  another 
individual  includes  a  reference  to  information  identifying  that 
individual  as  the  source  of  the  information  sought  by  the  request;  and 
that  subsection  is  not  to  be  construed  as  excusing  a  data  controller 
from  communicating  so  much  of  the  information  sought  by  the 
request  as  can  be  communicated  without  disclosing  the  identity  of  the 
other  individual  concerned,  whether  by  the  omission  of  names  or 
other  identifying  particulars  or  otherwise. 

(6)  In  determining  for  the  purposes  of  subsection  (4)(b)  whether  it  is 
reasonable  in  all  the  circumstances  to  comply  with  the  request 
without  the  consent  of  the  other  individual  concerned,  regard  shall  be 
had,  in  particular,  to— 

(a)  any  duty  of  confidentiality  owed  to  the  other  individual, 

(b)  any  steps  taken  by  the  data  controller  with  a  view  to  seeking 
the  consent  of  the  other  individual, 

(c)  whether  the  other  individual  is  capable  of  giving  consent,  and 
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(d)  any  express  refusal  of  consent  by  the  other  individual. 

(7)  An  individual  making  a  request  under  this  section  may ,  in  such 
cases  as  may  be  prescribed specify  that  his  request  is  limited  to 
personal  data  of  any  prescribed  description. 

(8)  Subject  to  subsection  (4),  a  data  controller  shall  comply  with  a 
request  under  this  section  promptly  and  in  any  event  before  the  end 
of  the  prescribed  period  beginning  with  the  relevant  day. 

19.  The  data  controller  has  not  cooperated  with  the  Commissioner's 
investigation  of  this  matter,  nor  responded  to  the  specific  enquiries 
made  by  her  in  relation  to  data  processed  about  the  complainant.  In 
the  circumstances,  and  on  the  basis  of  the  evidence  before  her  and  in 
the  public  domain,  the  Commissioner  considers  that  on  the  balance  of 
probabilities  the  data  controller  has  not  fully  complied  with  the 
complainant's  subject  access  request. 

20.  In  particular,  the  Commissioner  considers  that  further  personal  data 
about  the  complainant  must  be  held  in  order  for  the  data  controller  to 
have  generated  the  profile  of  the  complainant  that  is  set  out  in  the 
"Models"  category  of  the  spreadsheet  as  referred  to  in  paragraph  8(iii) 
above.  Furthermore,  the  Commissioner  considers  that  the  description 
of  the  sources  of  personal  data  provided  by  the  data  controller  were 
wholly  inadequate. 


21.  The  Commissioner  is  therefore  of  the  view  that  the  data  controller  has 
contravened  the  Sixth  Data  Protection  Principle. 


22.  The  Commissioner  has  considered,  as  she  is  required  to  do  under 
section  40(2)  of  the  DPA  when  deciding  whether  to  serve  an 
Enforcement  Notice,  whether  any  contravention  has  caused  or  is  likely 
to  cause  any  person  damage  or  distress.  The  Commissioner  takes  the 
view  that  damage  or  distress  to  the  complainant  is  likely  as  a  result  of 
him  being  denied  the  opportunity  of  correcting  inaccurate  personal 
data,  which  may  be  processed  by  the  data  controller,  because  they  are 
unable  to  establish  what  personal  data  are  being  processed  within  the 
statutory  timescale. 

23.  In  view  of  the  matters  referred  to  above  the  Commissioner 
hereby  gives  notice  that,  in  exercise  of  her  powers  under 
section  40  of  the  DPA,  she  requires  that  the  data  controller 
shall  within  30  days  of  the  data  of  this  notice  take  the  following 
steps: 

Provide  the  complainant  with: 

(i)  a  description  of  the  personal  data  processed  by  the  data 
controller  about  the  complainant; 

(ii)  a  description  of  the  purposes  for  which  that  data  are 
being  processed; 

(iii)  a  description  of  the  recipients  or  classes  of  recipients  to 
whom  the  data  are  or  may  be  disclosed; 

(iv)  copies  of  the  information  constituting  personal  data  about 
the  complainant  in  an  intelligible  form  in  accordance  with 
the  requirements  of  section  7  of  the  DPA  and  the  Sixth 
Data  Protection  Principle,  subject  only  to  the  proper 
consideration  and  application  of  any  exemption  from,  or 
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modification  to,  section  7  of  the  DPA  provided  for  in  or  by 
virtue  of  Part  IV  of  the  DPA  which  may  apply;  and 
(v)  a  description  as  to  the  source  of  that  personal  data. 

24.  Failure  to  comply  with  this  notice  is  a  criminal  offence. 

25.  There  is  a  right  of  appeal  against  this  Notice  to  the  First-tier  Tribunal 
(Information  Rights).  Information  about  appeals  is  set  out  in  the 
attached  Annex  1. 


Dated  the  4th  day  of  May  2018 


Signed: 


Elizabeth  Denham 

Information  Commissioner 

Information  Commissioner's  Office 

Wycliffe  House 

Water  Lane 

Wilmslow 

Cheshire 

SK9  5AF 
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ANNEX  1 


RIGHTS  OF  APPEAL  AGAINST  DECISIONS  OF  THE 
COMMISSIONER 


1.  Section  48  of  the  Data  Protection  Act  1998  gives  any  person 
upon  whom  an  Enforcement  Notice  has  been  served  a  right  of 
appeal  to  the  First-tier  Tribunal  (Information  Rights)  (the 
"Tribunal")  against  the  notice. 

2.  If  you  decide  to  appeal  and  if  the  Tribunal  considers:- 

a)  that  the  notice  against  which  the  appeal  is  brought  is  not 
in  accordance  with  the  law;  or 

b)  to  the  extent  that  the  notice  involved  an  exercise  of 
discretion  by  the  Commissioner,  that  she  ought  to  have 
exercised  her  discretion  differently, 

the  Tribunal  will  allow  the  appeal  or  substitute  such  other 
decision  as  could  have  been  made  by  the  Commissioner.  In  any 
other  case  the  Tribunal  will  dismiss  the  appeal. 

3.  You  may  bring  an  appeal  by  serving  a  notice  of  appeal  on  the 
Tribunal  at  the  following  address: 

GRC  &  GRP  Tribunals 
PO  Box  9300 
Leicester 
LEI  8DJ 

Tel:  0300  1234504 

Fax:  0870  739  5836 

Email:  GRC@hmcts.gsi.gov.uk 

Website:  www.iustice.qov.uk/tribunals/qeneral-requlatorv- 
chamber 


The  notice  of  appeal  should  be  served  on  the  Tribunal  within  28 
days  of  the  date  on  which  the  Enforcement  Notice  was  sent. 


11 


4.  The  statutory  provisions  concerning  appeals  to  the  First-tier 
Tribunal  (Information  Rights)  are  contained  in  sections  48  and 
49  of,  and  Schedule  6  to,  the  Data  Protection  Act  1998,  and 
Tribunal  Procedure  (First-tier  Tribunal)  (General  Regulatory 
Chamber)  Rules  2009  (Statutory  Instrument  2009  No.  1976 
(L.20)). 
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